Can Widewine server return fake key if the request is incorrect?

[anphunl]

I am trying to get the clearkey from Widewine.

• Got the PSSH from init mp4
• Used pywidevine to send request and decode to get hexa key.
• Converted hexa key to JSON Base64

But when I use the key with in M3U file via OTT player, it can't play (DRM error). The player can play another video with clearkey.

The format of M3U:

#EXTINF:-1 ....
#KODIPROP:inputstreamaddon=inputstream.adaptive 
#KODIPROP:inputstream.adaptive.manifest_type=dash
#KODIPROP:inputstream.adaptive.license_type=clearkey
#KODIPROP:inputstream.adaptive.license_key={"keys":[{"kty":"oct","kid":"xxx","k":"xxx"}],"type":"temporary"}
https://...mpd

My questions are:
1. Can Widewine server returns fake key if the PSSH or the header of the request is incorrect?
2. Can we have multiple PSSH in the init MP4 file? Currently the Python script return only 1 PSSH?

Thank you very much!

[larley]

1. The license server will respond to your challenge with a license. The challenge contains the PSSH (or Content ID/Key ID idk) which the server can use to give you the right keys. You might have noticed this if you've ever looked at the Key ID inside a PSSH and noticed that some Key IDs (not always all, if multiple) are the same as the Key IDs in front of the Keys (notice the key format <key_id>:<key>). Regrading your question: If the license server uses some cursed DRM system that accepts license data via the headers then yes, otherwise also yes, but you wouldn't call it 'fake', they would just be different.

2. I'm not sure if multiple Widevine PSSH(s?) are possible but multiple PSSH(s?) from different vendors are definitely possible and are actually often the case (Most of the time you have just Widevine and Microsoft PlayReady).

I'm also not sure what you're trying to do. From what i can tell, you're requesting Widevine Keys and putting them inside of an HLS manifest so you can play the content using OTT Player (something like Plex?).
I know that you can store licenses offline (used by Spotify for offline Music playback i think, can also be tested here). I know that pywidevine supports this "OFFLINE" license type as seen here.
It'd be fun to try saving offline licenses using pywidevine (never done it before), I just don't know if that would work in combination with OTT Player.

[anphunl]

Hi @larley,

Thanks for your quick response.

1. Yes, the kid in the clearkey is same as kid in PSSH. So I guest I got the correct key. The problem is I can't play it within m3u. Do you have any ideas about it?

2. Let me get all PSSHs and try all of them.

[larley]

1. I don't think OTT Player has support for this kind of HLS Tag ('KODIPROP') as it's not that common and also not mentioned inside the HLS Standard.

2. They should all contain the same Key IDs. You can actually convert a PlayReady PSSH to Widevine using pywidevine.

[anphunl]

@larley

1. Actually, it supports. I tried with another mpd with clearkey and it played normally. Also it's docs https://ottnav.github.io/faq.html#kodipropparametervalue

2. Thanks for your information

[larley]

Is OTT Player for Kodi? That would explain the name of the HLS Key.

[anphunl]

@larley: the OTT Navigator app for Android devices, but it is compatible with those Kodi tags